Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\creares
- <SYSTEM32>\tasks\windows_taskevent
Malicious functions
Patches code
in AMSI dll
- windowstasker.exe process, Amsi.dll module
Modifies file system
Creates the following files
- %APPDATA%\installer\installer 1.0.0\install\installer.msi
- %TEMP%\shi5285.tmp
- %TEMP%\msi5303.tmp
- %APPDATA%\installer\installer 1.0.0\install\installer1.cab
- %WINDIR%\temp\~df1a7d0bf220168da1.tmp
- %WINDIR%\installer\sourcehash{524472a3-358c-412c-b724-49ffdb703570}
- %WINDIR%\temp\~df8076a656b19179af.tmp
- %WINDIR%\temp\~df3d509694a9f64bb9.tmp
- %WINDIR%\temp\~dfffabd71e2bc37b05.tmp
- %TEMP%\scr6ab2.ps1
- %TEMP%\pss6ac3.ps1
- %TEMP%\pro6ae4.tmp
- %ALLUSERSPROFILE%\translationsconfig\windowstasker.exe
- %ALLUSERSPROFILE%\translationsconfig\guard.dll
- %ALLUSERSPROFILE%\translationsconfig\datareport.dll
- %ALLUSERSPROFILE%\translationsconfig\datareport.log
- %ALLUSERSPROFILE%\translationsconfig\msvcp140.dll
- %ALLUSERSPROFILE%\translationsconfig\vcruntime140.dll
- %WINDIR%\temp\~df08ed64148e3fa728.tmp
- %WINDIR%\temp\~df3cf48927254d0291.tmp
- %WINDIR%\temp\~dfccd078a859aca0a1.tmp
- %WINDIR%\temp\~df044ea6b324f9aa6d.tmp
- %TEMP%\scr8042.ps1
- %TEMP%\pss8054.ps1
- %WINDIR%\temp\~df8ab395929252798b.tmp
- %WINDIR%\temp\~dff4ac1e99a474965b.tmp
- %WINDIR%\temp\~df7062ab15a97c6d52.tmp
- %WINDIR%\temp\~dffa4e4bf0dddb9b8d.tmp
Deletes following files that it created itself
- %TEMP%\shi5285.tmp
- %TEMP%\msi5303.tmp
- %TEMP%\pro6ae4.tmp
- %TEMP%\pss6ac3.ps1
- %TEMP%\scr6ab2.ps1
- %TEMP%\pss8054.ps1
- %TEMP%\scr8042.ps1
- %APPDATA%\installer\installer 1.0.0\install\installer.msi
- %APPDATA%\installer\installer 1.0.0\install\installer1.cab
Network activity
Connects to
- 'ds###qw123.co':443
- 'my####rnalip.com':80
TCP
HTTP GET requests
- http://my####rnalip.com/raw
Other
- 'ds###qw123.co':443
UDP
- DNS ASK ds###qw123.co
- DNS ASK my####rnalip.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "%TEMP%\pss6AC3.ps1" -propFile "%TEMP%\msi6AB1.txt" -scriptFile "%TEMP%\scr6AB2.ps1" -scriptArgsFile "%TEMP%\scr6AB3.txt" -propSep " :<-...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "%TEMP%\pss8054.ps1" -propFile "%TEMP%\msi8041.txt" -scriptFile "%TEMP%\scr8042.ps1" -scriptArgsFile "%TEMP%\scr8043.txt" -propSep " :<-...
- '%ALLUSERSPROFILE%\translationsconfig\windowstasker.exe'
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%APPDATA%\Installer\Installer 1.0.0\install\Installer.msi" AI_SETUPEXEPATH=<Full path to file> SETUPEXEDIR=<Current directory>\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 17824269...
- '%WINDIR%\syswow64\schtasks.exe' /run /tn "Creares"
- '<SYSTEM32>\rundll32.exe' %ALLUSERSPROFILE%\TranslationsConfig\Guard.dll,RZ3UnNRgAmGT
